diff --git a/src/app/api/directory/route.ts b/src/app/api/directory/route.ts
index 35f1b392..a9963515 100644
--- a/src/app/api/directory/route.ts
+++ b/src/app/api/directory/route.ts
@@ -15,6 +15,7 @@ import {
 import { sanitizeSearchParams } from "@/lib/security/sanitize";
 
 const LNBITS_INVOICE_KEY = process.env.LNBITS_INVOICE_KEY || "";
+const MAX_DIRECTORY_PAGE = 10_000;
 
 const createListingSchema = z.object({
   title: z.string().min(1).max(100),
@@ -34,7 +35,10 @@ export async function GET(request: NextRequest) {
     const url = new URL(request.url);
     const search = url.searchParams.get("search") || "";
     const tag = sanitizeSearchParams(url, "tag");
-    const page = parseInt(url.searchParams.get("page") || "1");
+    const parsedPage = parseInt(url.searchParams.get("page") || "1", 10);
+    const page = Number.isFinite(parsedPage) && parsedPage > 0
+      ? Math.min(parsedPage, MAX_DIRECTORY_PAGE)
+      : 1;
     const limit = 20;
     const offset = (page - 1) * limit;